Code exposes risk in unpatched IE hole

Iria · Nov 21, 2005, 09:18 PM

Exploit code for the latest patched version of Microsoft's Internet Explorer was published Monday, which could put users at risk of a remote code attack on their system, according to advisories issued by several security firms.

The exploit code could take advantage of the "extremely critical" flaws in IE 5.5 and IE 6 running on XP Service Pack 2 (SP2) and IE 6 running on Windows 2000 SP4, according to an advisory by security researcher Secunia.

Once a user is tricked into visiting a malicious Web site, a flaw in javascript can be exploited automatically without user intervention.

"An attacker could use the exploit to run any code they want to on a person's system," said Thomas Kristensen, Secunia's chief technology officer. "It could be they want to launch some really nasty code on a user's system."

The flaw lies in a Javascript component of IE used for loading Web pages onto a computer, according to an advisory from SANS Internet Storm Center.
__________
Read More / Source: News.com

Nov 21, 2005, 09:18 PM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	Code exposes risk in unpatched IE hole Exploit code for the latest patched version of Microsoft's Internet Explorer was published Monday, which could put users at risk of a remote code attack on their system, according to advisories issued by several security firms. The exploit code could take advantage of the "extremely critical" flaws in IE 5.5 and IE 6 running on XP Service Pack 2 (SP2) and IE 6 running on Windows 2000 SP4, according to an advisory by security researcher Secunia. Once a user is tricked into visiting a malicious Web site, a flaw in javascript can be exploited automatically without user intervention. "An attacker could use the exploit to run any code they want to on a person's system," said Thomas Kristensen, Secunia's chief technology officer. "It could be they want to launch some really nasty code on a user's system." The flaw lies in a Javascript component of IE used for loading Web pages onto a computer, according to an advisory from SANS Internet Storm Center. __________ Read More / Source: News.com